Composer Workflows for Modern Drupal Projects

Composer is the dependency authority for modern Drupal. A safe workflow separates dependency resolution in development from deterministic installation in production.

Treat both Composer files as code

The manifest expresses intent; the lock file records the solved dependency graph. Review both. Production should run composer install --no-dev, never resolve a new graph with composer update.

Update with a defined scope

Inspect outdated packages and advisories, back up, update the intended Drupal packages with dependencies, run database updates, rebuild caches, export configuration changes, and test as anonymous and authenticated users.

Use patches as temporary debt

Document why a patch exists, its upstream issue, and removal criteria. Prefer maintained releases and keep version constraints broad enough for security patches but narrow enough to communicate supported majors.

Working example

composer outdated "drupal/*"
composer audit
composer update "drupal/core-*" --with-all-dependencies
drush updatedb -y
drush cache:rebuild
drush config:export --diff

Key Takeaways

• Resolve dependencies in development and install the lock file in production.
• Scope updates and test the complete deployment sequence.
• Track every patch back to an upstream issue.

Further Reading

• Composer documentation
• Updating Drupal core with Composer